Logo for Si Novi, a UK-based software consultancy Logo for Si Novi, a UK-based software consultancy

Security that was there from the first line of code

Security is a way of building software rather than a pass you make over it at the end. We design it in, from authentication and encryption to the data protection duties you carry under UK GDPR, and keep it current for as long as we run the system.
The problem

The expensive security problems are the ones designed in by accident.

You rarely notice them at the time. A login flow that trusts an ID the browser sent. A field that gets written straight into a query. A library that was current when you shipped and three years out of date by the time someone comes probing. None of these looked like security decisions when they were made.

That is the trouble with treating security as a phase at the end. By then the decisions are already in the code, and a hardening pass can only paper over them. It is far cheaper to make the safe choice while the thing is still being designed than to unpick it once real customer data depends on the shape you got wrong.

In business operations software

Data moves between systems - a quoting tool, a finance package, a survey app - and every hop is somewhere personal data can leak or a request can be forged. The duty is UK GDPR, and the risk usually lives in the joins between systems that nobody quite owns.

In SaaS platform development

You hold a lot of people's data in one place, and a single slip in authorisation can show one customer another customer's records. Isolation between tenants and an access check on every request are most of the job.

How we work

We work out what needs protecting before we decide how to protect it.

  1. 01

    Design it in

    We look at what data the system actually needs, where it will live and who should ever touch it, and we design for least privilege from the outset. Most security comes down to decisions made here, long before anyone writes an authentication check.

  2. 02

    Build it securely

    Authentication, authorisation checked on every request, validation of anything a client sends, and encryption in transit and at rest. Where identity is involved we use AWS Cognito rather than rolling our own, because a bespoke login layer is a liability you maintain forever.

  3. 03

    Keep it current

    A dependency that was safe at launch becomes a way in as vulnerabilities are found and patched. Someone has to keep libraries current, watch the logs and act when something looks wrong. In most of our engagements that is still us, years later.

What's included

What you get, in more detail.

  1. 01

    Authentication and access control

    Proper authentication, with multi-factor where it matters, and authorisation checked on every request rather than assumed once someone has logged in. Access follows least privilege, so each part of the system can reach only the data its job needs.

    Where we can, identity runs on AWS Cognito rather than a bespoke login layer we would have to secure and maintain forever.

  2. 02

    Encryption, in transit and at rest

    TLS on everything that moves, and encryption at rest through AWS Key Management Service, so the data stays unreadable even to someone who reaches the storage underneath it.

  3. 03

    Input validation and the common web risks

    We validate anything a client sends and build against the vulnerabilities that actually get exploited - injection, cross-site scripting, broken authentication and access control - following NCSC and OWASP guidance rather than guesswork.

  4. 04

    Data protection and UK GDPR

    Data protection by design and by default, built in from the start: storing personal data properly, answering subject access and deletion requests without a scramble, and backups that account for both.

    We handle personal data ourselves and are registered with the ICO, so these are duties we live with rather than only advise on.

  5. 05

    Reviews of software you already run

    If you want an honest second opinion on an application you already have, we audit PHP and JavaScript codebases and write up what we find with practical fixes, in priority order. We can carry out the remediation too, and keep things patched afterwards.

“Si Novi have been amazing. We were blown away by their responsiveness and the quality of their work. The journey is just beginning and we couldn't have found a better partner to help us on our way.”
Ross Ringham, Managing Director, Spacesuit Media

Work built to be trusted with real data

The stack is usually Node.js or PHP on AWS, with Cognito handling identity and the platform's own controls doing the heavy lifting. We are an AWS Select Tier Services Partner and we run a Well-Architected review on every engagement, its security pillar included, which is how a problem gets found on a whiteboard rather than in an incident.

Read the Cloud Excellence Framework
Questions

The things buyers ask us first.

  • Are you ISO 27001 or Cyber Essentials certified?

    No, and we would rather tell you that plainly than imply otherwise. What we do have is AWS Select Tier Services Partner status and a Well-Architected review on every engagement, its security pillar included, and we build to NCSC and OWASP guidance.

    If a particular certification is a hard requirement for your procurement, say so early and we will be straight about what we can and cannot meet.

  • Can you review the security of software we already run?

    Yes. We audit PHP and JavaScript applications, report what we find with practical fixes in priority order, and can carry out the remediation and keep things patched afterwards.

  • Who can see your data?

    As few people and systems as possible. We work to least privilege, so we and the software itself touch only the data a task needs, and it is encrypted in transit and at rest. It is your business's data, held in your own AWS account, and we are registered with the ICO and treat it under the same duties as our own.

  • Will building security in slow us down?

    Less than fixing it later will. Designing the safe choice in while the system is still on the whiteboard costs a fraction of unpicking an unsafe one after launch, and it means the answer to a security question is usually already in the code rather than sitting on a backlog.

Related

Security is never a job on its own.

Work we have done for businesses like yours

Golf course
Insurance platform rebuild Published 2026

Rubber Ring

Rubber Ring's digital insurance business had outgrown its original platform.

Discover how we rebuilt it on a modern, event-sourced architecture on AWS - a single-table DynamoDB source of truth streamed into a PostgreSQL read model, with containerised React Router 7 and PHP applications on ECS Fargate - and migrated the entire live book in one cutover.

Rubber Ring logo
Read more: Rubber Ring
Duwio workspace interface
Cloud-native SaaS platform Published 2025

Duwio

Working with Spacesuit Media, we transformed years of experience in image delivery into Duwio - a new SaaS platform for creative professionals, re-engineered from the ground up on AWS.

Built on an AWS well-architected foundation, it enables photographers and agencies to store, tag, search and deliver images seamlessly from anywhere in the world.

Read more: Duwio
GT World racing cars in motion
React Native mobile app Published 2025

SRO Motorsports Group

Si Novi partnered with Whiteflame and SRO Motorsports Group to build a new GT World app, replacing a Europe-only version with one that covers every SRO championship worldwide.

It brings together live video, timing, schedules, team data and race reminders each fan can tune to the series they follow, on a single React Native codebase over a serverless AWS backend.

Read more: SRO Motorsports Group
A package-holiday beach with sun loungers at golden hour
Serverless API rebuild Published 2025

Distribute

Distribute serves package-holiday data to a range of downstream partners through a business-critical API.

Discover how we rebuilt that API as a modern, serverless service on AWS - introducing a clean HTTP/JSON interface while keeping every existing consumer working through a zero-downtime migration.

Distribute logo
Read more: Distribute
Jaguar Land Rover tooling and equipment
Distribution web platform Published 2024

Jaguar Land Rover

Discover how Si Novi partnered with Jaguar Land Rover to build a scalable, secure AWS-powered web application for global tooling distribution.

Learn about the innovative solution, including recent enhancements for electric vehicle tooling, that supports 13 languages and over 40 regions worldwide.

Read more: Jaguar Land Rover
All case studies